Parent

Class/Module Index [+]

Quicksearch

Rex::PeScan::Scanner::Generic

Attributes

pe[RW]
regex[RW]

Public Class Methods

new(pe) click to toggle source
# File lib/rex/pescan/scanner.rb, line 11
def initialize(pe)
        self.pe = pe
end

Public Instance Methods

config(param) click to toggle source
# File lib/rex/pescan/scanner.rb, line 15
def config(param)
end
scan(param) click to toggle source
# File lib/rex/pescan/scanner.rb, line 18
                def scan(param)
                        config(param)

                        $stdout.puts "[#{param['file']}]"
                        pe.all_sections.each do |section|
                                hits = scan_section(section, param)
                                hits.each do |hit|
                                        vma  = pe.rva_to_vma(hit[0])

                                        next if (param['filteraddr'] and [vma].pack("V").reverse !~ /#{param['filteraddr']}/)

                                        msg  = hit[1].is_a?(Array) ? hit[1].join(" ") : hit[1]
                                        $stdout.puts pe.ptr_s(vma) + " " + msg
                                        if(param['disasm'])
                                                #puts [msg].pack('H*').inspect
                                                insns = []
                                
                                                msg.gsub!("; ", "\n")
                                                if msg.include?("retn")
                                                        msg.gsub!("retn", "ret")
                                                end
                                                #puts msg
                                                begin
                                                        d2 = Metasm::Shellcode.assemble(Metasm::Ia32.new, msg).disassemble
                                                rescue Metasm::ParseError
                                                        d2 = Metasm::Shellcode.disassemble(Metasm::Ia32.new, [msg].pack('H*'))
                                                end
                                                addr = 0
                                                while ((di = d2.disassemble_instruction(addr)))
                                                        insns << di.instruction
                                                        disasm = "0x%08x\t" % (vma + addr)
                                                        disasm << di.instruction.to_s
                                                        $stdout.puts disasm
                                                        addr = di.next_addr
                                                end
#                                               ::Rex::Assembly::Nasm.disassemble([msg].pack("H*")).split("\n").each do |line|
#                                                       $stdout.puts "\tnasm: #{line.strip}"
                                                #end
                                        end
                                end
                        end
                end
scan_section(section, param={}) click to toggle source
# File lib/rex/pescan/scanner.rb, line 61
def scan_section(section, param={})
        []
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.